nixamp 0.49.0 → 0.50.1

package/dist/store-routes.js

@@ -0,0 +1,189 @@
+/**
+ * The music store's pages and API on nixamp.com (music-store.ts).
+ *
+ *   GET  /buy?server=&kind=&artist=&album=&n=     what it is, the price, email + coin, Pay
+ *   GET  /purchases/:id?t=                        the receipt: waiting, or Download the zip
+ *   GET  /api/v1/store/coins                      the coins nixamp's CoinPay business takes
+ *   POST /api/v1/store/checkout                   {server, kind, artist, album?, n?, email, coin} -> {url}
+ *   GET  /api/v1/store/purchases                  the signed-in account's music (My music on /radio)
+ *   GET  /api/v1/store/purchases/:id?t=           one purchase by its link
+ *   GET  /api/v1/store/grant?g=                   a server asks whether a grant is good
+ */
+import { createHash } from "node:crypto";
+import { PRICES } from "./music-store.js";
+import { SupportError } from "./support.js";
+const PURCHASE = /^\/purchases\/([0-9a-f-]{36})$/;
+const ONE = /^\/api\/v1\/store\/purchases\/([0-9a-f-]{36})$/;
+export function isStorePath(path) {
+    return path === "/buy" || PURCHASE.test(path) || path === "/api/v1/store/coins" || path === "/api/v1/store/checkout"
+        || path === "/api/v1/store/purchases" || ONE.test(path) || path === "/api/v1/store/grant";
+}
+function escape(text) {
+    return text.replace(/[&<>"']/g, (one) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[one]);
+}
+function hash(text) {
+    return `'sha256-${createHash("sha256").update(text).digest("base64")}'`;
+}
+const STYLE = `
+:root{--bg:#080c09;--fg:#e8efe9;--muted:#9aa79d;--card:#0e1410;--line:#1f2a22;--accent:#3ddc84}
+*{box-sizing:border-box}html,body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
+main{max-width:560px;margin:0 auto;padding:40px 16px}
+.card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:24px}
+h1{margin:0 0 4px;font-size:1.5rem;overflow-wrap:anywhere}.by{color:var(--muted);margin:0 0 16px}
+.price{font-size:2rem;font-weight:800;color:var(--accent);margin:8px 0}
+ul{color:var(--muted);padding-left:20px}
+label{display:block;color:var(--muted);font-size:.9rem;margin:12px 0 4px}
+input,select{width:100%;padding:10px;border-radius:10px;border:1px solid var(--line);background:var(--bg);color:var(--fg);font:inherit}
+button,a.go{display:block;text-align:center;text-decoration:none;margin-top:18px;width:100%;padding:12px;border:0;border-radius:999px;background:var(--accent);color:#06120a;font:inherit;font-weight:800;cursor:pointer}
+button:disabled{opacity:.5;cursor:wait}
+button:focus-visible,input:focus-visible,select:focus-visible,a:focus-visible{outline:3px solid var(--accent);outline-offset:2px}
+#status{min-height:1.4em;margin-top:12px;color:var(--muted)}
+small{display:block;margin-top:18px;color:var(--muted)}small a,p a{color:var(--accent)}
+`;
+const BUY_SCRIPT = `
+(async () => {
+  const $ = (s) => document.querySelector(s);
+  const status = $("#status");
+  try {
+    const coins = await (await fetch("/api/v1/store/coins")).json();
+    const cheap = ["USDC_POL", "USDC_SOL", "SOL", "POL", "LTC", "USDC_BASE", "USDC"];
+    const list = (coins.coins || []).slice().sort((a, b) => (cheap.indexOf(a) + 1 || 99) - (cheap.indexOf(b) + 1 || 99));
+    $("#coin").replaceChildren(...list.map((c) => Object.assign(document.createElement("option"), { value: c, textContent: c })));
+  } catch { status.textContent = "Payments are not available right now."; }
+  $("#buy").addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const button = $("#pay");
+    button.disabled = true;
+    status.textContent = "Starting the checkout…";
+    const form = new FormData(event.currentTarget);
+    try {
+      const r = await fetch("/api/v1/store/checkout", { method: "POST", headers: { "content-type": "application/json" }, credentials: "same-origin",
+        body: JSON.stringify({ ...JSON.parse(document.body.dataset.item), email: form.get("email"), coin: form.get("coin") }) });
+      const body = await r.json();
+      if (!r.ok) throw new Error(body.error || "The checkout did not start.");
+      status.textContent = "Taking you to CoinPay…";
+      location.href = body.url;
+    } catch (error) {
+      status.textContent = error.message;
+      button.disabled = false;
+    }
+  });
+})();
+`;
+export const STORE_CSP = ["default-src 'none'", `script-src ${hash(BUY_SCRIPT)}`, `style-src ${hash(STYLE)}`, "img-src https:", "connect-src 'self'", "form-action 'none'", "base-uri 'none'", "frame-ancestors 'none'"].join("; ");
+function page(title, body, data = "") {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escape(title)} · nixamp</title><meta name="robots" content="noindex"><link rel="icon" href="/favicon.png" type="image/png"><style>${STYLE}</style></head>
+<body${data ? ` data-item="${escape(data)}"` : ""}><main>${body}</main>${data ? `<script>${BUY_SCRIPT}</script>` : ""}</body></html>`;
+}
+function price(cents) {
+    return cents < 100 ? `${cents}¢` : `$${(cents / 100).toFixed(cents % 100 ? 2 : 0)}`;
+}
+function html(response, status, text, method) {
+    response.writeHead(status, { "content-type": "text/html; charset=utf-8", "content-security-policy": STORE_CSP, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+    response.end(method === "HEAD" ? undefined : text);
+}
+export async function handleStoreRoutes(request, response, path, url, ctx) {
+    if (!isStorePath(path))
+        return false;
+    const method = request.method ?? "GET";
+    const store = ctx.store;
+    try {
+        if (path === "/buy" && (method === "GET" || method === "HEAD")) {
+            let item;
+            try {
+                item = await store.describe(Object.fromEntries(url.searchParams.entries()));
+            }
+            catch (error) {
+                html(response, 404, page("Not for sale", `<div class="card"><h1>Not for sale</h1><p class="by">${escape(error.message)}</p></div>`), method);
+                return true;
+            }
+            const me = await ctx.account().catch(() => null);
+            const what = item.kind === "song" ? "One song" : item.kind === "album" ? `The album, ${item.songs} songs` : `Everything by ${escape(item.artistName)}, ${item.songs} songs so far`;
+            const cover = item.kind === "artist" ? "" : `<img src="${escape(`${item.server}/api/v1/label/${item.artist}/${item.album}/cover.jpg`)}" alt="" width="160" height="160" style="border-radius:10px;float:right;margin:0 0 8px 12px;max-width:40%;height:auto">`;
+            html(response, 200, page(`Download ${item.title}`, `<div class="card">${cover}
+<h1>${escape(item.title)}</h1><p class="by">${escape(item.artistName)}</p>
+<div class="price">${price(item.amountCents)}</div>
+<ul><li>${what}, as MP3</li><li>Album artwork and the lyrics, inside each file and beside it</li><li>One zip, yours to keep; download again any time</li></ul>
+<form id="buy">
+<label for="email">Email (your download link goes here)</label>
+<input id="email" name="email" type="email" required autocomplete="email" value="${escape(me?.email ?? "")}">
+<label for="coin">Pay with</label>
+<select id="coin" name="coin" required></select>
+<button id="pay" type="submit">Pay ${price(item.amountCents)} with crypto</button>
+</form>
+<p id="status" role="status" aria-live="polite"></p>
+<small>Payments go through <a href="https://coinpayportal.com">CoinPay</a> to nixamp.com. For small amounts pick a coin with low fees (USDC on Polygon or Solana, SOL, LTC). Listening on the live stations is always free.${me ? "" : ` <a href="/radio#music">Sign in</a> with the same email to keep everything under My music.`}</small>
+</div>`, JSON.stringify({ server: item.server, kind: item.kind, artist: item.artist, album: item.album, n: item.n })), method);
+            return true;
+        }
+        const receipt = PURCHASE.exec(path);
+        if (receipt && (method === "GET" || method === "HEAD")) {
+            const purchase = await store.get(receipt[1], url.searchParams.get("t") ?? "");
+            if (!purchase) {
+                html(response, 404, page("No such purchase", `<div class="card"><h1>No such purchase</h1><p class="by">That link is not one of ours.</p></div>`), method);
+                return true;
+            }
+            const body = purchase.status === "paid"
+                ? `<div class="card"><h1>${escape(purchase.title)}</h1><p class="by">${escape(purchase.artistName)} · paid ${price(purchase.amountCents)}</p>
+<a class="go" href="${escape(store.zipUrl(purchase))}" download>Download the zip</a>
+<small>MP3s with the cover art and lyrics, plus each song's .lyrics.txt, cover.jpg and album.json. Keep this page's address (it is in your email too) to download again. Signed in to nixamp.com as ${escape(purchase.email)}, everything you bought is under <a href="/radio#music">My music</a>, to play or download.</small></div>`
+                : `<div class="card"><h1>${escape(purchase.title)}</h1><p class="by">${escape(purchase.artistName)} · ${price(purchase.amountCents)} in ${escape(purchase.coin)}</p>
+<p>Waiting for your payment. Once CoinPay confirms it, your download is here and in your email (${escape(purchase.email)}). This page checks again when you reload it.</p>
+<a class="go" href="https://coinpayportal.com/pay/${escape(purchase.paymentId)}">Open the payment</a></div>`;
+            html(response, 200, page(purchase.title, body), method);
+            return true;
+        }
+        if (path === "/api/v1/store/coins" && method === "GET") {
+            ctx.json(response, 200, { coins: await ctx.coins(), prices: { song: PRICES.song / 100, album: PRICES.album / 100, artist: PRICES.artist / 100 } });
+            return true;
+        }
+        if (path === "/api/v1/store/checkout" && method === "POST") {
+            let input;
+            try {
+                input = JSON.parse(await ctx.readBody(request));
+            }
+            catch {
+                ctx.json(response, 400, { error: "the body is not JSON", code: "bad_json" });
+                return true;
+            }
+            const me = await ctx.account().catch(() => null);
+            const made = await store.checkout(input, me);
+            ctx.json(response, 201, made);
+            return true;
+        }
+        if (path === "/api/v1/store/purchases" && method === "GET") {
+            const me = await ctx.account().catch(() => null);
+            if (!me) {
+                ctx.json(response, 401, { error: "sign in to see your music", code: "unauthorized" });
+                return true;
+            }
+            ctx.json(response, 200, { email: me.email, purchases: (await store.forAccount(me)).map((one) => store.view(one)) });
+            return true;
+        }
+        const one = ONE.exec(path);
+        if (one && method === "GET") {
+            const purchase = await store.get(one[1], url.searchParams.get("t") ?? "");
+            if (!purchase) {
+                ctx.json(response, 404, { error: "no such purchase", code: "not_found" });
+                return true;
+            }
+            ctx.json(response, 200, { purchase: store.view(purchase) });
+            return true;
+        }
+        if (path === "/api/v1/store/grant" && method === "GET") {
+            const scope = store.check(url.searchParams.get("g") ?? "");
+            ctx.json(response, scope ? 200 : 403, scope ? { ok: true, scope } : { ok: false });
+            return true;
+        }
+        ctx.json(response, 405, { error: "not like that", code: "method_not_allowed" });
+        return true;
+    }
+    catch (error) {
+        if (error instanceof SupportError)
+            ctx.json(response, error.status, { error: error.message, code: error.code });
+        else
+            ctx.json(response, 500, { error: error instanceof Error ? error.message : String(error), code: "internal" });
+        return true;
+    }
+}

package/dist/support.d.ts

@@ -30,6 +30,20 @@ export declare class Support {
         business: string;
         coins: string[];
     }>;
+    /** Any CoinPay checkout on nixamp's business (a purchase in the store): no holder, no floor but a cent. */
+    pay(input: {
+        amountUsd: number;
+        coin: unknown;
+        description: string;
+        metadata: Record<string, unknown>;
+        redirect: string;
+        order: string;
+    }): Promise<{
+        url: string;
+        paymentId: string;
+    }>;
+    /** Whether CoinPay counts this payment as paid; null when it did not answer. */
+    isPaid(paymentId: string): Promise<boolean | null>;
     /** A CoinPay checkout for this much, to this holder; the address to send the payer to. */
     checkout(input: {
         holder?: unknown;

package/dist/support.js

@@ -81,6 +81,47 @@ export class Support {
         }
         return this.merchant;
     }
+    /** Any CoinPay checkout on nixamp's business (a purchase in the store): no holder, no floor but a cent. */
+    async pay(input) {
+        const { business, coins } = await this.coins();
+        const coin = typeof input.coin === "string" ? input.coin.toUpperCase() : "";
+        if (!coins.includes(coin))
+            throw new SupportError(`Pay with one of: ${coins.join(", ")}.`, 400, "invalid_coin");
+        const created = await this.provider("/api/payments/create", {
+            method: "POST",
+            headers: { "idempotency-key": `nixamp-${input.order}` },
+            body: JSON.stringify({
+                business_id: business,
+                amount_usd: Math.max(0.01, Math.round(input.amountUsd * 100) / 100),
+                currency: coin.toLowerCase(),
+                payment_method: "crypto",
+                description: input.description.slice(0, 200),
+                metadata: { app: "nixamp", ...input.metadata },
+                redirect_url: input.redirect,
+            }),
+        });
+        const payment = created["payment"];
+        const id = typeof payment?.id === "string" ? payment.id : "";
+        if (!/^[A-Za-z0-9_-]{6,80}$/.test(id))
+            throw new SupportError("The checkout did not start; nothing was charged. Try again.", 502, "provider");
+        return { url: `https://coinpayportal.com/pay/${id}`, paymentId: id };
+    }
+    /** Whether CoinPay counts this payment as paid; null when it did not answer. */
+    async isPaid(paymentId) {
+        try {
+            const response = await (this.options.fetcher ?? fetch)(`https://coinpayportal.com/api/payments/${encodeURIComponent(paymentId)}`, {
+                signal: AbortSignal.timeout(15_000),
+                headers: { authorization: `Bearer ${this.options.key}` },
+            });
+            if (!response.ok)
+                return null;
+            const body = (await response.json());
+            return PAID.has(String(body.payment?.status ?? ""));
+        }
+        catch {
+            return null;
+        }
+    }
     /** A CoinPay checkout for this much, to this holder; the address to send the payer to. */
     async checkout(input) {
         const holder = typeof input.holder === "string" ? this.holder(input.holder) : undefined;

package/dist/track-facts.d.ts

@@ -26,6 +26,14 @@ export interface TrackFacts {
     art: string;
     /** Where the track's words are, on this station's link; "" when none are known. */
     lyrics: string;
+    /** An AI label song: where to buy it, its album, or everything by the artist (nixamp.com/buy). */
+    store?: {
+        song: string;
+        album: string;
+        artist: string;
+        artistName: string;
+        albumTitle: string;
+    } | null;
 }
 export interface Holder {
     id: string;

package/dist/zip-stream.d.ts

@@ -0,0 +1,13 @@
+import type { Writable } from "node:stream";
+export declare function crc32(bytes: Uint8Array, crc?: number): number;
+export interface ZipEntry {
+    /** The name inside the zip, with "/" between folders. */
+    name: string;
+    /** A file on disk, or the bytes themselves. */
+    path?: string;
+    bytes?: Uint8Array;
+}
+/** The zip's size, known before a byte is sent, for Content-Length. */
+export declare function zipSize(entries: ZipEntry[]): number;
+/** Writes the zip to `out` (left open). */
+export declare function writeZip(out: Writable, entries: ZipEntry[], now?: Date): Promise<void>;

package/dist/zip-stream.js

@@ -0,0 +1,119 @@
+/**
+ * A zip written as it is sent: files are stored (MP3s and JPEGs do not
+ * shrink), each CRC-32 is worked out while its bytes go by and written after
+ * them in a data descriptor, so nothing is staged on disk and the first byte
+ * leaves at once. Plain zip (no ZIP64): fine for an album or an artist's
+ * catalogue, refused past 4 GB.
+ */
+import { createReadStream, statSync } from "node:fs";
+const TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+export function crc32(bytes, crc = 0) {
+    let c = ~crc >>> 0;
+    for (let i = 0; i < bytes.length; i++)
+        c = TABLE[(c ^ bytes[i]) & 0xff] ^ (c >>> 8);
+    return ~c >>> 0;
+}
+/** DOS date and time, which is what zip keeps. */
+function dosTime(at) {
+    return {
+        time: (at.getHours() << 11) | (at.getMinutes() << 5) | Math.floor(at.getSeconds() / 2),
+        date: ((Math.max(1980, at.getFullYear()) - 1980) << 9) | ((at.getMonth() + 1) << 5) | at.getDate(),
+    };
+}
+function write(out, chunk) {
+    return new Promise((resolve, reject) => {
+        if (out.destroyed)
+            return reject(new Error("the download was closed"));
+        if (out.write(chunk))
+            return resolve();
+        const fail = () => { out.off("drain", go); reject(new Error("the download was closed")); };
+        const go = () => { out.off("close", fail); resolve(); };
+        out.once("drain", go);
+        out.once("close", fail);
+    });
+}
+/** The zip's size, known before a byte is sent, for Content-Length. */
+export function zipSize(entries) {
+    let total = 22;
+    for (const entry of entries) {
+        const name = Buffer.byteLength(entry.name);
+        const size = entry.bytes ? entry.bytes.length : statSync(entry.path).size;
+        total += 30 + name + size + 16 + 46 + name;
+    }
+    return total;
+}
+/** Writes the zip to `out` (left open). */
+export async function writeZip(out, entries, now = new Date()) {
+    const { time, date } = dosTime(now);
+    const central = [];
+    let offset = 0;
+    for (const entry of entries) {
+        const name = Buffer.from(entry.name, "utf8");
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(0x04034b50, 0);
+        local.writeUInt16LE(20, 4);
+        local.writeUInt16LE(0x0808, 6); // sizes in a descriptor after the data; names are UTF-8
+        local.writeUInt16LE(0, 8); // stored
+        local.writeUInt16LE(time, 10);
+        local.writeUInt16LE(date, 12);
+        local.writeUInt16LE(name.length, 26);
+        await write(out, local);
+        await write(out, name);
+        let crc = 0;
+        let size = 0;
+        if (entry.bytes) {
+            crc = crc32(entry.bytes);
+            size = entry.bytes.length;
+            await write(out, entry.bytes);
+        }
+        else {
+            for await (const chunk of createReadStream(entry.path)) {
+                const bytes = chunk;
+                crc = crc32(bytes, crc);
+                size += bytes.length;
+                await write(out, bytes);
+            }
+        }
+        const descriptor = Buffer.alloc(16);
+        descriptor.writeUInt32LE(0x08074b50, 0);
+        descriptor.writeUInt32LE(crc, 4);
+        descriptor.writeUInt32LE(size, 8);
+        descriptor.writeUInt32LE(size, 12);
+        await write(out, descriptor);
+        const header = Buffer.alloc(46);
+        header.writeUInt32LE(0x02014b50, 0);
+        header.writeUInt16LE(20, 4);
+        header.writeUInt16LE(20, 6);
+        header.writeUInt16LE(0x0808, 8);
+        header.writeUInt16LE(0, 10);
+        header.writeUInt16LE(time, 12);
+        header.writeUInt16LE(date, 14);
+        header.writeUInt32LE(crc, 16);
+        header.writeUInt32LE(size, 20);
+        header.writeUInt32LE(size, 24);
+        header.writeUInt16LE(name.length, 28);
+        header.writeUInt32LE(offset, 42);
+        central.push(header, name);
+        offset += 30 + name.length + size + 16;
+        if (offset > 0xffffffff)
+            throw new Error("too big for a zip (4 GB)");
+    }
+    const directory = Buffer.concat(central);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(entries.length, 8);
+    end.writeUInt16LE(entries.length, 10);
+    end.writeUInt32LE(directory.length, 12);
+    end.writeUInt32LE(offset, 16);
+    await write(out, directory);
+    await write(out, end);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.49.0",
+  "version": "0.50.1",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/ai-label.ts

@@ -218,7 +218,7 @@ const PLAN_SYSTEM = [
 const LYRICS_SYSTEM = [
   "You write original English song lyrics for an AI singer. Never quote or imitate an existing song and never name a real artist.",
   "Put each section tag on its own line: [Intro], [Verse 1], [Pre-Chorus], [Chorus], [Verse 2], [Bridge], [Outro].",
-  "Use two verses, a chorus sung two or three times and a bridge; vivid, specific, singable lines that rhyme where it sounds natural.",
+  "Use two verses of four lines, a four-line chorus sung two or three times, a pre-chorus of two lines and a bridge of two to four lines; vivid, specific, singable lines that rhyme where it sounds natural. Never just one line under a section.",
   "Only the words that are sung, no stage directions or notes. Answer as JSON: {\"lyrics\": \"the lyrics, lines separated by \\n\"}.",
 ].join(" ");
 
@@ -810,6 +810,53 @@ export class AiLabel {
     return match![2] === "mp3" ? { path: song.file, type: "audio/mpeg" } : { path: song.lyricsFile, type: "text/plain; charset=utf-8" };
   }
 
+  /** The label song at this path, for the now-playing card's Download buttons. */
+  songAt(file: string): { artist: string; album: string; n: number; title: string; artistName: string; albumTitle: string } | null {
+    for (const artist of this.artists.values()) {
+      for (const album of artist.albums) {
+        const song = album.songs.find((one) => one.file === file);
+        if (song) return { artist: artist.key, album: album.key, n: song.n, title: song.title, artistName: artist.name, albumTitle: album.title };
+      }
+    }
+    return null;
+  }
+
+  /** A released song's MP3, when this grant's scope covers it. */
+  songFile(artistKey: string, albumKey: string, n: number): string {
+    return this.artists.get(artistKey)?.albums.find((one) => one.key === albumKey)?.songs.find((one) => one.n === n && one.file)?.file ?? "";
+  }
+
+  /**
+   * What a purchase's zip holds: every released song in scope with its words,
+   * and each album's cover and album.json, under <artist>/<year>-<album>/.
+   * Null when there is nothing (or no such artist).
+   */
+  zipFor(scope: { kind: "song" | "album" | "artist"; artist: string; album: string; n: number }): { name: string; entries: Array<{ name: string; path?: string; bytes?: Uint8Array }> } | null {
+    const artist = this.artists.get(scope.artist);
+    if (!artist) return null;
+    const albums = artist.albums.filter((one) => scope.kind === "artist" || one.key === scope.album);
+    const entries: Array<{ name: string; path?: string; bytes?: Uint8Array }> = [];
+    const top = fileName(artist.name);
+    for (const album of albums) {
+      const songs = album.songs.filter((one) => one.file && (scope.kind !== "song" || one.n === scope.n));
+      if (songs.length === 0) continue;
+      const folder = `${top}/${album.year}-${fileName(album.title)}`;
+      for (const song of songs) {
+        entries.push({ name: `${folder}/${songBase(song)}.mp3`, path: song.file });
+        entries.push({ name: `${folder}/${songBase(song)}.lyrics.txt`, bytes: Buffer.from(`${song.lyrics}\n`) });
+      }
+      if (album.cover) entries.push({ name: `${folder}/cover.jpg`, path: album.cover });
+      entries.push({ name: `${folder}/album.json`, bytes: Buffer.from(`${JSON.stringify({
+        artist: artist.name, genre: artist.genre, album: album.title, year: album.year, concept: album.concept,
+        label: this.settings.holder, copyright: `℗ ${album.year} ${this.settings.holder}`, madeWithAi: true,
+        songs: songs.map((one) => ({ n: one.n, title: one.title, seconds: one.seconds, file: `${songBase(one)}.mp3`, lyrics: `${songBase(one)}.lyrics.txt` })),
+      }, null, 2)}\n`) });
+    }
+    if (entries.length === 0) return null;
+    const what = scope.kind === "artist" ? "Discography" : scope.kind === "album" ? albums[0]!.title : this.songFile(scope.artist, scope.album, scope.n) ? albums[0]!.songs.find((one) => one.n === scope.n)!.title : "Song";
+    return { name: `${fileName(artist.name)} - ${fileName(what)}.zip`, entries };
+  }
+
   private require(key: string): LabelArtist {
     const artist = this.artists.get(key);
     if (!artist) throw new StationError("not_found", "no such artist on the label", 404);

package/src/label-routes.ts

@@ -10,20 +10,34 @@ import { createHash } from "node:crypto";
 import { createReadStream, statSync } from "node:fs";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { ROSTER, type AiLabel, type PublicArtist } from "./ai-label.ts";
+import { covers, PRICES, type GrantVerifier } from "./music-store.ts";
+import { writeZip, zipSize } from "./zip-stream.ts";
 import { StationError } from "./stations.ts";
 
 // Listening is free on the live stations (with their breaks); the songs as
-// files are sold, so only the words and the cover are public here.
-const FILE = /^\/api\/v1\/label\/([a-f0-9]{10})\/([a-f0-9]{8})\/(\d{1,3}\.txt|cover\.jpg)$/;
+// files are sold, so only the words and the cover are public here, and an
+// MP3 or a zip needs a grant from nixamp.com's store (music-store.ts).
+const FILE = /^\/api\/v1\/label\/([a-f0-9]{10})\/([a-f0-9]{8})\/(\d{1,3}\.(?:txt|mp3)|cover\.jpg)$/;
 
-/** Whether this path is the label's public face. */
+/** Whether this path is the label's public face (an MP3 or the zip still asks for its grant). */
 export function isPublicLabelPath(path: string): boolean {
-  return path === "/label" || path === "/api/v1/label" || FILE.test(path);
+  return path === "/label" || path === "/api/v1/label" || path === "/api/v1/label/zip" || FILE.test(path);
+}
+
+/** nixamp.com's page that sells this: a song, an album or everything by the artist. */
+export function buyLink(site: string, server: string, kind: "song" | "album" | "artist", artist: string, album = "", n = 0): string {
+  const query = new URLSearchParams({ server, kind, artist, ...(kind !== "artist" ? { album } : {}), ...(kind === "song" ? { n: String(n) } : {}) });
+  return `${site}/buy?${query.toString()}`;
 }
 
 export interface LabelRoutesContext {
   label: AiLabel;
   canControl: boolean;
+  /** Checks a store grant with nixamp.com; without it nothing is sold or handed out. */
+  grants?: GrantVerifier;
+  /** nixamp.com, where the store is, and this server's public address (for Buy links). */
+  site?: string;
+  publicBase?: string;
   json: (response: ServerResponse, status: number, body: unknown) => void;
   readBody: (request: IncomingMessage) => Promise<string>;
 }
@@ -91,7 +105,8 @@ export async function handleLabelRoutes(
         return true;
       }
       if (path === "/label") {
-        const page = renderLabel(label.publicView());
+        const shop = ctx.grants && ctx.site && /^https:\/\//.test(ctx.publicBase ?? "") ? { site: ctx.site, server: ctx.publicBase! } : undefined;
+        const page = renderLabel(label.publicView(), shop);
         response.writeHead(200, { "content-type": "text/html; charset=utf-8", "content-security-policy": LABEL_CSP, "cache-control": "public, max-age=300" });
         response.end(method === "HEAD" ? undefined : page);
         return true;
@@ -100,7 +115,45 @@ export async function handleLabelRoutes(
         ctx.json(response, 200, label.publicView());
         return true;
       }
+      const url = new URL(request.url ?? "/", "http://x");
+      const grant = url.searchParams.get("grant") ?? "";
+      if (path === "/api/v1/label/zip") {
+        const scope = ctx.grants ? await ctx.grants.check(grant) : null;
+        if (!scope) {
+          ctx.json(response, 403, { error: "that download link has expired or is not one of ours: open your purchase again for a fresh one", code: "bad_grant" });
+          return true;
+        }
+        const zip = label.zipFor(scope);
+        if (!zip) {
+          ctx.json(response, 404, { error: "nothing to download yet", code: "not_found" });
+          return true;
+        }
+        response.writeHead(200, {
+          "content-type": "application/zip",
+          "content-length": String(zipSize(zip.entries)),
+          "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(zip.name)}`,
+          "cache-control": "private, no-store",
+        });
+        if (method === "HEAD") {
+          response.end();
+          return true;
+        }
+        await writeZip(response, zip.entries).catch(() => response.destroy());
+        response.end();
+        return true;
+      }
       const [, artist, album, what] = FILE.exec(path)!;
+      if (what!.endsWith(".mp3")) {
+        const scope = ctx.grants && grant ? await ctx.grants.check(grant) : null;
+        const n = Number(what!.split(".")[0]);
+        const file = scope && covers(scope, artist!, album!, n) ? label.songFile(artist!, album!, n) : "";
+        if (!file) {
+          ctx.json(response, 403, { error: "songs as files are for the people who bought them; listening on the live stations is free", code: "not_bought" });
+          return true;
+        }
+        sendFile(request, response, file, "audio/mpeg", file.split("/").pop() ?? "");
+        return true;
+      }
       const found = label.publicFile(artist!, album!, what!);
       if (!found) {
         ctx.json(response, 404, { error: "no such file on the label", code: "not_found" });
@@ -213,6 +266,7 @@ audio{width:100%;max-width:360px;height:36px}
 details{margin-top:4px}summary{cursor:pointer;color:var(--muted);font-size:.9rem}
 pre.lyrics{white-space:pre-wrap;font:inherit;font-size:.95rem;margin:8px 0 0;padding:12px;border-radius:8px;background:var(--bg)}
 .dl{font-size:.85rem}.soon{color:var(--muted);font-size:.85rem}
+a.buy{display:inline-block;font-weight:700;text-decoration:none;border:1px solid var(--accent);border-radius:999px;padding:2px 10px}
 footer{margin-top:48px;color:var(--muted);font-size:.85rem}footer a{color:inherit}
 `;
 
@@ -225,25 +279,39 @@ export const LABEL_CSP = [
   "base-uri 'none'", "form-action 'none'", "frame-ancestors 'none'",
 ].join("; ");
 
-function renderAlbum(artist: PublicArtist, album: PublicArtist["albums"][number]): string {
+type Shop = { site: string; server: string } | undefined;
+
+function price(cents: number): string {
+  return cents < 100 ? `${cents}¢` : `$${(cents / 100).toFixed(cents % 100 ? 2 : 0)}`;
+}
+
+function buy(shop: Shop, kind: "song" | "album" | "artist", artist: string, album = "", n = 0, what = ""): string {
+  if (!shop) return "";
+  return `<a class="buy" href="${escape(buyLink(shop.site, shop.server, kind, artist, album, n))}">Download ${what || kind} · ${price(PRICES[kind])}</a>`;
+}
+
+function renderAlbum(artist: PublicArtist, album: PublicArtist["albums"][number], shop: Shop): string {
   const base = `/api/v1/label/${artist.key}/${album.key}`;
   const cover = album.cover ? `<img class="cover" src="${base}/cover.jpg" alt="Cover of ${escape(album.title)}" width="160" height="160" loading="lazy">` : `<div class="blank" aria-hidden="true"></div>`;
   const songs = album.songs.map((song) => `<li><div class="song"><span class="n">${song.n}.</span><span class="t">${escape(song.title)}</span><span class="d">${minutes(song.seconds)}</span></div>`
     + `<details><summary>Lyrics</summary><pre class="lyrics">${escape(song.lyrics)}</pre></details>`
-    + `<div class="dl"><a href="${base}/${song.n}.txt">lyrics.txt</a></div></li>`).join("");
+    + `<div class="dl"><a href="${base}/${song.n}.txt">lyrics.txt</a>${shop ? ` · ${buy(shop, "song", artist.key, album.key, song.n, "MP3")}` : ""}</div></li>`).join("");
   return `<div class="album">${cover}<div><h4>${escape(album.title)} <span class="d">(${album.year})</span></h4>`
     + `${album.concept ? `<p class="concept">${escape(album.concept)}</p>` : ""}`
     + `${album.complete ? "" : `<p class="soon">Still being recorded: new songs land here as they are finished.</p>`}`
+    + `${shop ? `<p>${buy(shop, "album", artist.key, album.key, 0, "the album, MP3s with art and lyrics")}</p>` : ""}`
     + `<ol class="songs">${songs}</ol></div></div>`;
 }
 
 /** The label's catalogue as a page: no script, plays in any browser. */
-export function renderLabel(view: ReturnType<AiLabel["publicView"]>): string {
+export function renderLabel(view: ReturnType<AiLabel["publicView"]>, shop?: Shop): string {
   const label = view.holder.replace(/,?\s+(inc|llc|ltd|gmbh|co)\.?$/i, "");
   const nav = view.genres.length > 1 ? `<nav class="genres" aria-label="Genres">${view.genres.map((one) => `<a href="#${escape(one.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}">${escape(one.genre)}</a>`).join("")}</nav>` : "";
   const sections = view.genres.map((genre) => `<section class="genre" id="${escape(genre.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}" aria-labelledby="g-${escape(genre.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}">`
     + `<h2 id="g-${escape(genre.genre.toLowerCase().replace(/[^a-z0-9]+/g, "-"))}">${escape(genre.genre)}${genre.station ? ` <a href="/watch/${escape(genre.station)}">Listen live, free →</a>` : ""}</h2>`
-    + genre.artists.map((artist) => `<article class="artist"><h3>${escape(artist.name)}</h3>${artist.bio ? `<p class="bio">${escape(artist.bio)}</p>` : ""}${artist.albums.map((album) => renderAlbum(artist, album)).join("")}</article>`).join("")
+    + genre.artists.map((artist) => `<article class="artist"><h3>${escape(artist.name)}</h3>${artist.bio ? `<p class="bio">${escape(artist.bio)}</p>` : ""}`
+      + `${shop ? `<p>${buy(shop, "artist", artist.key, "", 0, "everything by them")}</p>` : ""}`
+      + `${artist.albums.map((album) => renderAlbum(artist, album, shop)).join("")}</article>`).join("")
     + `</section>`).join("");
   return `<!doctype html>
 <html lang="en">